SC Linux security and has a Linux now, a lot of you probably thinking, oh my God, SL Linux, it's
very complicated.
OK, I do agree, it is somewhat complicated to a degree.
But for people who have already spent time in it and been working with SC, Linux already find it easier
than initially how they thought.
So one thing I will promise you that I will try my best to explain how as c Linux works.
But keep in mind, it's a very, very big topic that I might not be able to cover every aspect of astill
Linux.
So again, I'll try my best.
So let's see.
First talk about what is Essy Linux as a running definition, its security enhanced Linux.
It's a Linux kernel security module that provides a mechanism for supporting access control security
policy, including mandatory access control.
I got this definition straight from Wikipedia.
If you go ahead and search online, you'll find that definition right there.
And the second thing I do want to cover is it's a project of United States National Security Agency,
NSA and NSC, Linux community.
The other one, both of them work together, came up, of course, at the beginning.
NSA was the one who was involved, who wants to enhance or add more security around Linux.
So I have went over the definition of SC Linux from Wikipedia.
Now I am going to tell you exactly how I can explain you in a graphical and easier way.
And I really hope that you understand how a Linux works.
And what is it for?
Let's take an example of a server.
So we have a Linux server and it has directories directory has files and all other different files and
other directories.
And also the server has processes like an office, web server or FTP server.
Also, it has sockets that whenever it starts a program to communicate to one another Linux machine,
it needs to open up a socket.
And it has a memory hole that is, as you know, is managed or comes under the ownership of users and
groups.
Right.
We all know that.
And how we control the permissions is by of course, we assigning them to who owns that and which group
owns that.
And then there are three level of permission we do, and that is reedited, executable, and each one
of them are divided into users.
The first three bits for users, second three bits for group, and through the last three bits for others.
So all that is controlled through change mod.
So you could a user can do change mod to whatever that they wanted to change it to see if you own a
file or if you create a file, let's call it file one.
You could do a change mod on that file and control the permission as however you want to view it.
This type of access is called DHC Discretionary Access Control where user has control over everything.
Now comes the SC Linux.
What s the Linux is.
It's basically a mandatory access control and it goes around this discretionary access control.
So what it means that let's say you have a user and user is http user in your environment and let's
say that user has been compromised by a hacker.
So what I have is here is if the Apache HTP server is compromised, an attacker can now use the process
to read files and use a home directory unless a specific Zelenik policy rule was added or configured
to allow such access.
In simple words, what I could show you here is if that user HTP user only if SC Linux is enabled.
What this silliness can do is it tells the user, hey, you do have access to this file.
For example, wah wah wah doped up e-mail directory, but I am not going to give you access to var dub
dub dub CGI Deshpande.
Now think of it, both of these directories are actually owned by that HDB user.
Right.
So isn't that how funny it is that the same user can access one directory and cannot access the other
or can access one file but cannot access the NFL?
Yes, that is possible through SC Linux.
That's why they came in and says, hey, guys, this is not good.
Maybe one user, let's say I have TSOL can access a file and slash home.
I have Zoll and a file.
Bovey don't want him to access any other file in the same directory.
Well this because again if that users compromised that user could access other directories too.
And you want want to prevent that.
So at the end result is the user cannot do change to whatever the user likes.
That's what see Linux is.
That's how it enhances the security of your Linux server.
Hopefully this diagram and me explaining this way makes you understand how the Linux works and why there's
a need of Selznick's.
Now, moving on, let's get into the detail of the functional functionality of ASIL Linux and how we
can make use of it as Linux options.
There are three astill Linux option number one, by default, when you have a Linux machine installed
primarily, let's say in RedHat, S.O.S and Fedora, toplessness distribution's by default as Linux
comes as enabled, meaning it is in enforcing mode.
Then there's another mode that is called permissive mode, permissive mode.
What it does is tells the astill Linux, Hey, I'm not going to enable you said don't do anything.
Only what you should do is only log activity like as if you are enabled.
So this way, if you are using the first time as Linux, then you should always do permissive so you
could try and error trial and error type of things you could do unless you fully comfortable.
Then you could go ahead and do end forcing again.
Always tried to do permissive than enforcing.
Then of course the third one would be, as you know, is disabled.
So if you do not want to use SC Linux at all, you could just go ahead and make it disable and none
of its functionality would work at all.
Now, so far that I know if I have to ballpark, I would say about 50 to 60 percent of the time people
have disabled AC Linux.
And the reason, number one reason for being AC Linux disable in the environment is because, of course,
as I said, it is complicated and a lot of time people do find it complicated and simply they could
go in and disable it.
But what my take is, is that if you are running any of your Linux machine in a DMZ environment, which
is like public facing environment, then you should definitely consider enabling AC Linux.
OK, moving on to check as the Linux status, whether your system is running Linux or whether it has
a Selex enabled or not, you would do S e status or get enforced.
This would tell you if your system has at Selznick's enabled or not, setting aside Linux, you will
have to do set inforce zero to do and or disable mode or you could do set and force one to enable it.
But again, this will only enable or disable while you are on the system.
The moment your system reboot, the setting will go away.
Now how you can make those settings permanent, just like any service you have to modify AC Linux config
file for permanent setting and that file is ETSI.
As always, ATSE is a configuration directory, so you should have that in LCAC Linux config file and
there is a parameters inside of that configuration file that says Asil Linux equal and forcing Asulin
equal disable whichever the setting that you want to pick.
Of course, don't forget permissive.
Then before you modify as Selena's config file, that is something definitely I wanted to tell you,
it is very important, even if you have to write it down before you play around with AC Linux, please,
if it's a virtual machine, create a snapshot of your VM.
So stop everything right now.
Go ahead and create a snapshot before you try anything on.
Why?
The reason I'm saying that again, S.E Linux is built around security.
If you make changes, that is not something that you wanted to do.
Maybe you're going to have a problem boarding up your system or is going to take a long time to label
every file system.
Now, what does labeling mean?
We'll cover that later.
But again, my suggestion to you right now is go ahead and create a snapshot of your time machine.
If you are running a physical machine, go ahead and create a backup of your physical machine or create
some type, some type of means where you could revert back to your original setting.
Then before you reboot your system, let's say if you have and forced AC Linux in your azzi.
SC Linux config file always do Slashdot or Relabelled, this is going to tell the system, hey, I have
just enabled disable AC Linux, especially enabling it, go ahead and relabel all the file system directories,
whatever that you have, relabelled them right now.
So they are aware of Sete Linux enablement.
So make sure if you don't do that then you have to boot, then he has to go to the relabelling again.
It's going to take you a really long time and you're probably going to think your system is not boarding
up and then you're going to try different things and you're going to end up not boarding up the system
at all.
All right, I'm going to try a couple of things to show you on my Linux machine, how does how to show
whether it's enforce or not.
So I have my Linux machine open right here.
I am logged in, as rude as you could see, I have a pound sign, but still I will always check to make
sure I'm logged in as route.
So if I wanted to check the status of educed status Southsea status, as you can see right now, I see
status enabled.
But don't go by this.
You have to do is right here.
Current mode.
It is saying that my current mode is enforcing meaning.
I do have AC Linux and it is enabled and running in my system.
You could also get the same result, not exactly the same result, but you want to find out whether
it's enforced or not.
You do get enforce.
And it would tell you that, yes, it is enforcing again, if you wanted to set it to enforcing or disabling,
you have to do set enforce zero to disable one to enable the file that you would need to modify for
permanent setting.
That file is located at sea surface as Selznick's.
Let's get the file out.
And while his config.
You could see in the wild before I had only this line see Lennix equal enforcing.
I also added this line myself.
You probably don't see this line in your configuration because I added that Manoly and the reason I
added Manoly, so I don't have to type it the disabled hole again or I do not want to make any mistake.
All I ever do is I'll go into the file, take out the pound, add the pound here, and it will make
the changes the way I want.
So that's the file you need to keep in mind that you should make the change to if you wanted to enforce
or disable.
Moving on.
There are two main concepts of the next one is labeling and the other one is type enforcement.
So Etsy, Linux is running.
It's enforced.
Now, how does ATSE Linux keep track of files, directories and all the processes that we talked about?
First thing that Azzi Linux does, it labels every file and directory in your file system.
Again, it's an enhanced way of enhancing your security.
And that's say, if you have a file or a directory, it creates a label with that, just like a label
tag.
And that label has four different type of information.
One is this user.
Second is their role.
There is a type and the fourth one is the level of mostly focus on the type, because most of the time
a type is the one that is used that keeps all the files, ownership or security separate from one another.
To list the label of a directory, if you wanted to see what type of label it has, you have to do this
Dash L, Z and User SBN.
HTP D is just the example that I picked.
This is the file and you will see as a result.
It will come up as this and you'll see right here where I have highlighted and rectangular red object.
It has system which is for user object, which is for roll HD PD underscore C underscore T that's the
type.
And the last one I saw is the level.
The again the main focus is underscore exi underscore t you will find that every file or directory,
if they are in a different directories, will have a different type.
As you know, this is executable user been PD is an executable.
You can run that, it will start up a script and it will start to htp process.
That is why it has been given the e e c executable type similarly.
If you do want to list a directory, you would have to do list space D for directories and a Z again
to ATSE EPD.
This is a directory for configuration file for EPD and the result will come up like this again.
Same thing users.
The same role is the same, but it has changed to type.
Type again is the most important part or thing that you have to work with.
If you are going to copy the file, let's say that is in user SBN or let's say Warde, a ASTM directory
and you move it somewhere else.
Remember one thing, it is not taking the permissions off the other or the other source destination
it.
So it is taking the information of the source that so you have to modify the type when you actually
move it.
Otherwise the next will not allow you to read it.
OK, so let me try a couple of these commands.
I'll clear my screen and the first one I will try on else minus L uppercase, Z slash user slash has
been HTP D and as you can see right here.
This is what shows up, and this is a label of SC Lennix, if I had Selznick's disabled, it would not
have shown up right here.
Again, the first one, all of this label has four different categories and each category is separated
by the call.
And so first one again is user.
Second one is rolled or one is the type and the last one is the level.
And again, this is the most important one that you should be focusing on that you could make a change
to.
All right.
Try on the directory.
Dezi at C EPD.
Again, it is labeled as config, HPD and desktop config, this one is Leslieville executable.
You see, the AC Linux keeps the distinction between one file or directory with another is by assigning
these types that it says, hey, this is a config file.
Hey, this is executable file.
Now I'll see who has access to executable and who has access to config.
If I were if I were to do the same thing in my home directory, let's say that's minus Dezi home, I
have Sol, you will see it is coming as yuzu, which every user will have and their home.
That's how you could differentiate as a home directory.
I could also make a change on the user as well as the object.
All right, let's keep moving on.
As a Web server runs it, process is labeled in memory as well as like EPD under 40.
So not only directories or files are labeled Biase Linux, the process is also labeled.
You could check that process label only if it's running right.
Because kernel starts of the process, then it keeps that process information memory.
Without starting it up, there won't be any label.
So to check while the process is running, you do X or whatever the option that you want to use and
of course uppercase in the grep for the process.
And you will see you get to list a process depending on how many processes you're running.
And here is information about that type that we talked about.
Sorry, I actually captured the system in the school as well, which is not the type, the type is under
Scootin.
All right, to check the socket level, if the label is assigned at the socket level, yes, it is.
And you'll see right here again, I, I actually highlighted the wrong type system.
Underscore is a role, not the type that the type would be in this Gharty.
All right, so let me try to look the same thing for process and for the socket.
So first, before I look for it, I wanted to make sure my HPD is running.
For those who do not have DPD install in your system, you first need to check whether you have the
package installed by running R.P.M. keyway.
First of all, let me clear the screen R.P.M. keyway grab for EDP.
OK, so I do have a package installed.
OK, now if I have a package installed, I need to run it.
But of course before I run it, I'll need to make sure that it's running already or not.
So system CTL status.
OK, it is not running, it is active, you can see right here.
So that is why if even if I do minus F or whatever I want to do and I type HTP, it's not going to Grubert,
so I need to start it to start.
I will use the same command system ctrl instead of status.
I'll just start and htp.
It has started now.
Now I will do.
System still status, and now you will see this status active and running.
Now let's go to.
Look for the label as the Lennox label for that process, so I'll loop's A, X, Z and grep for Speedy
and right here you'll see it has this entire thing is the label.
And the type that I'm saying is this this is the type that you could change or kernel can change if
you specify some type of policy.
All right, now let's look at the socket nets that.
Tea and LPC and for HTP, and again, the socket has the same label and a type two wood, and this is
the type.
All right, so now we talked about already how do we check the labels of Selznick's to every file directory
and programs and sockets?
So let's move on and let's talk about the commands to manage the Linux settings.
There's a command called manage to label or change the label to all of these followings.
There is another command, S.H. Con, that could be used as well to change the labels.
So the labels.
Can be applied to all of these entities right below the log in, user poor interface module, node file
context booleans, permissive state don't audit.
I have Hublot highlighted Bolian in this entire slide is because Boolean, I would say is is the one
that is mostly used while you are using SLN.
Let's talk about boolean.
What is boolean a boolean is kind of like an on and off switch.
So there are predefine out of the box Bolian that come with a Selznick's, so if you have AC Linux install
and it just started, the Bolian is already there.
Now, what is a billion billion?
As an example, it tells the Selznick's, hey, do we allow FTB server to access home directories?
Meaning do we allow FTP user, the user FTP server when it runs it has a user, right ftp user, not
just pacifically to be user ftp.
Do we allow that user to access the home directories now at the Bolian stays on.
That means yes.
If the booleans is off then it means it's off.
It cannot.
You could get a list of bullying.
Cover that in a minute.
Another example would be can EPD talk to Helda or any name directory services.
You would have a list of other things to like.
Can HTP talk to send mail, to send mail or not, whether it's on or off so you can make it on or off
depending on your requirement.
And of course many other booleans how to get a list of all booleans.
If we have, what do we get when we install Linux?
What do we get out of the box to get the list?
You have to run the command, get SC, Boulle and of course, Dashi is for all or there's another command
that you could get, which is C manage boolean dash list, which will also give you pretty much the
same result.
As I said, you should go over every boolean that you have in your system.
So this way you don't have to create your own or come up or install on your own.
There are tons of them that Essy Linux offers you right off the box to enable or turn on a boolean.
Now, you have identified this should be on or this should be off.
Now, how do you enable it or how do you turn on and off now?
Again, keep in mind, this is where we are making changes only when see Linux is enabled.
Once that is enabled, only then you could do all those different configuration within SC Linux.
Anyway, to turn on the booleans, you could have you could run the command set Cebull space minus P
space, Bolian underscore name, whichever the name that you will see when you run the get Cebull.
And of course, on four.
On all four.
Check error messages related to ESTA Linux, if you define anything in Linux, if you set any see any
Boolean and there is an error messages in it, or if you are running an a party server, for example,
and end up not your server, supposed to read a file from a user home directory.
Let's say I have saw you start up the Apache server and you get an error message that it cannot read.
Well, then, of course, you would go in and run a command journal, ctrl channel control.
This command is kind of a log.
It keeps track of everything, every error message that is related to SC, like it would tell you,
hey, the reason you cannot run that, and I have noticed, is because a party server apparently cannot
read the file that you wanted to read that is located in slash home I absol directly.
And why is that?
Because you probably have given everyone to read the file, meaning on the other you have given like
r to read everyone but still can't read it.
Why?
Because as I said, it probably has a label and the label says that it is only allowed to read for that
only.
So you have to change the label, especially the type to give it that label to word HTP.
To change the type in a label, you can run the S.H. Con minus T like EPD and of course this contact
T file name, if it's a system file, you'd give that label.
If the home directory you give that home directory label, you can also run the command s e manege minus
t epd and discourses contant t and finally.
So these are the two commands that you could run to change the labeling of SC Linux.
Let me try a few different commands.
And to clear the screen, to get a list of all booleans, I get get Cebull, Dash A.
You see so many of them came up, let me try to do more so I'll see one page at a time.
OK, Kluster can network connect, can the closer connect a network of no, another example, Deman
used to it now.
DKP use Helda No off.
ATP use sifts no off, so FCP user cannot access the six.
And most of them are disabled or off, EPD can connect FTP server, so meaning if you go to a Web server
and end the Web server, you you probably wanted to give a functionality to click somewhere and transfer
the file.
And the only way to transfer the file if you have a FTP running on your server.
So that is running.
All is good.
Everything is hunky dory.
Perfect.
But now you still cannot.
It's still not working.
Why.
Because no one your links is on No.
Two.
The HDP can connect to FTP server is off.
So you have to go in and make it or turn it on and so on.
There are so many of them.
As I said, you could go into one by one.
And if you really wanted to get yourself familiar with all of them, you should go through each one
of them, read about it and find out what they are for.
And again, I'm sorry, I cannot go over all of them, because if I do, this becomes a course on its
own.
And I do not want to waste all those people time that who really don't want to get into details of Linux,
but they do want to understand how it works.
And as a system administrator point over, you can use Linux for a regular day to day work anyway.
If you want to find out how many booleans we have, let's say out of the box, you could do get a Cebull
dash A and you could do W.S. minus and you will see there are a hundred and ten booleans.
That you could actually maintain or manage, so if you want to set a boolean so let's say I wanted to
do something with HTP, so the media grew HTP.
This is all with HTP, what HP can do and what HP cannot.
So let's say I want HTP to connect to ETPs.
Well, the first copy this.
And right now, as you see, it's up, so before I just do crêpe, I'll just give up on that Pacific
one it says is off, right?
We wanted to make it on or turn it on, so I'll do a set.
Cebull.
My A.P..
Bolian Napoléon name, as we already know, which is this and then on.
Hit enter, it could take anywhere from two seconds to 10 seconds, depending on your system, of course.
Now, if you want to confirm whether it turned on or not, what do you do?
You go through the same get as Cebull.
And you'll see it is on anyway, that is something I just showed you for the laptop.
I'll go ahead and turn it back off.
And it should turn it back off now again and forcing get and forcing gets you what whether AC Linux.
Is an enabler or not, if you want to disable it?
Again, make sure talk to you, manager, talk to your security team if you want to disable it or not,
whether you want it to get something out of it anyway.
So the point is if you want to disable it.
Permanently.
You would do V.I..
But before I do, we I said, make sure you take a snapshot, so I'll make a copy, first of all.
I see Linux config to see, didn't I put it in the temporary?
Temp can fake that or itchy rich, so I made a copy.
Good, now I will modify a Linux config file.
Come down and now I will put a comment on enforcing and I will take out a Selznick's equal disabled
now, it should disable it.
I will go ahead and save it once I save it.
What do I have to do when you do get force?
It will still say enforcing for you to make it change globally or to the system.
Why do you have to do a reboot?
So let's see.
When I reboot, his server unexpectedly closed now a connection that's fine, that's perfectly fine
because I am using PUDI.
All right, so from this point on, I am going to wait until the system comes back online, so I am
going to.
Fast forward.
From this point.
OK, so I got the connection back on, I'm going to close the other window behind it and now I've got
a new connection.
I would log in as route.
Now, if I do get inforce.
It says disabled.
So that's how you could get the information above this enable or disable what was the other command
that we would need to run to check whether it's enabled or disable?
S e status and now is saying Selznick's Lennix status is disabled, so you could run Ellis' minus Z.
Oh, sorry, Dezi on my home directory.
And it will still show that it has the label on it, because before it had a Linux enabled, but this
whole label, please make sure this whole label is not enforced right now.
You can move this part anywhere and it will work based on the permissions which is defined here.
And this permission is what is DHC discretionary access control, not through Mac, which is mandatory
access control.
So anyway, this is the whole topic about Linux.
Again, as I said, there is a lot more than what I have covered, but it gets into really nifty and
green down in the weeds.
So if you wanted to know more about AC Linux, I have included in this section the entire guide, the
Configuration Administration User Guide on Linux.
So please, I would definitely recommend you to go over it, read about it, and hopefully you get all
the answers that you're looking for.